Data Processing Agreement

1. What this is and when it applies

This Data Processing Agreement (the "DPA") forms part of the Terms of Service between you (the customer) and UserHint. It applies automatically, without signature, whenever data-protection laws such as the GDPR or the UK GDPR apply to personal data that visitors submit through widgets embedded on your sites ("Submission Data").

For Submission Data, you are the controller and UserHint is your processor. For data about you as our customer (your account and session data), we are the controller, and our Privacy Policy applies instead of this DPA.

2. Details of the processing

• Subject matter and purpose: collecting feedback submitted by visitors through your widgets, storing it, and showing it to you in the dashboard.
• Duration: for as long as you use the Service, and until Submission Data is deleted under Section 7.
• Nature of the processing: receipt, storage, display, and deletion. We do not use Submission Data for our own purposes, and we do not use it to train machine-learning models.
• Categories of data subjects: visitors of your websites who use a widget.
• Categories of personal data: the message a visitor writes and any optional rating; the URL and title of the page they were on; their IP address (kept at most 30 days); their browser user agent and coarse device details; and their country, derived from the IP address.
• Special categories: none intended. The Terms forbid using the Service to collect credentials, payment card numbers, government identifiers, health data, or other special-category data.

3. Our obligations as processor

We will:

• process Submission Data only to provide the Service and on your documented instructions, which these Terms and your use of the dashboard constitute, unless the law requires otherwise, in which case we will tell you first where we lawfully can;
• ensure that every person authorized to process Submission Data is bound by confidentiality;
• apply technical and organizational measures appropriate to the risk, as described on our Security page;
• notify you without undue delay after becoming aware of a personal data breach affecting Submission Data, with the information you need for your own notification duties;
• help you, taking into account the nature of the processing, respond to data subjects exercising their rights, and meet your security and impact-assessment obligations;
• delete Submission Data as described in Section 7; and
• make available the information reasonably necessary to demonstrate compliance with this DPA, and answer your reasonable audit questions in writing. Where the law entitles you to more than written answers, an audit will be at your expense, no more than once a year, on 30 days' notice, and must not disrupt the Service.

4. Subprocessors

You authorize us to use the following subprocessors to run the Service. This list is the current, complete list:

Before adding or replacing a subprocessor that processes Submission Data, we will update this page and give you at least 14 days' notice by email or by a notice in the dashboard. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may close your account.

5. International transfers

Submission Data is stored in data centers in the United States. Where providing the Service transfers personal data protected by the GDPR or UK GDPR outside the EEA or the UK without an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two: controller to processor), and for UK transfers the UK Addendum to them, are incorporated into this DPA by reference, with you as data exporter and UserHint as data importer, and with the processing details in Section 2 and the security measures on our Security page completing their annexes.

6. Data subject requests

If a visitor contacts us directly about their Submission Data, we will pass the request to you rather than answer it ourselves, unless the law requires us to act directly. You can already view and delete individual submissions from the dashboard, which covers most access and erasure requests without our help.

7. Deletion and return

You can delete individual submissions, whole widgets, or your entire account from the dashboard; each deletes the covered Submission Data immediately and permanently. Before closing your account, you may request an export of your Submission Data at the address in Section 9. Visitor IP addresses are removed from submissions within 30 days regardless.

8. Liability and order of precedence

The limitations of liability in the Terms of Service apply to this DPA. If this DPA conflicts with the Terms, this DPA controls for the processing of Submission Data; if the Standard Contractual Clauses conflict with either, the Clauses control.

9. Contact

Questions about this DPA, or a request under it? Contact us at [email protected].